Always-on in-memory ring of recent trace events. Captures at TRACE for the
mermaid crates regardless of RUST_LOG (deps capped at INFO), so a bug
report carries the last ~2000 events without asking the user to reproduce
under elevated logging. Secrets are redacted AT CAPTURE, not at read time.
Confirm a destructive action (default NO). assume_yes (a --yes/--force
flag) is the explicit opt-in for scripted use; without it a non-interactive
session refuses rather than proceeding silently. prompt is printed
verbatim, followed by [y/N]:.
Length in bytes of the longest exact overlap between the tail of prev
and the head of continuation — the “resume echo” a model sometimes emits
when continuing a reply that was cut by a per-response output cap.
Drain all complete newline-terminated lines out of buf, decoding each
as UTF-8 and dropping the trailing \n. Any partial trailing line stays
in buf so the caller can append more bytes and try again.
Drain all complete SSE events out of buf, returning the payload of
each data: field. The [DONE] sentinel and non-data: fields are
filtered out. Each returned String is exactly one event’s data
(multi-line data: fields are joined with \n, per the SSE spec).
Run cmd to completion with a deadline, capturing stdout/stderr — a
Command::output() that cannot hang. On expiry the child is killed and
(bounded-best-effort) reaped, and ErrorKind::TimedOut comes back. stdin
is null.
Return (creating if needed) a 0700 per-user scratch directory under the app
data dir. Callers write transient sensitive files here instead of the shared
system temp dir.
Read at most max_bytes from path. Returns (bytes, truncated) where
bytes.len() <= max_bytes and truncated is true when the file was
longer than the cap.
Retry an async operation with exponential backoff, retrying on ANY error.
For selective retries (skip terminal errors like HTTP 4xx) use
retry_async_if.
Retry an async operation with exponential backoff, but only while
is_retryable returns true for the error. A terminal error (e.g. an HTTP
4xx on a non-idempotent POST) is surfaced immediately instead of being
retried max_attempts times (#85).
Fail-closed policy: refuse a destructive/untrusted action when there is no
interactive terminal to confirm at and the explicit opt-in was not passed.
Also defeats yes | mermaid …, since a pipe is not a TTY.
Truncate content to a maximum character count, keeping the HEAD (char-boundary
safe). Prefer truncate_middle where the tail matters (command/tool output);
this remains for per-item web caps where head-only is acceptable.
Truncate content to about max_chars characters, keeping the HEAD and the
TAIL with an elision marker in the middle (char-boundary safe). Command/tool
output and web pages put the most important content — compiler errors, exit
summaries, page footers — at the END, so head-only truncation discarded
exactly what mattered. Content that already fits is returned unchanged.
Feed input to cmd’s stdin and wait for exit under a deadline — the
write-side sibling of output_with_timeout. stdout/stderr go to null,
so tools that fork a long-lived holder of their fds (wl-copy and xclip
serve the selection from a background fork) can’t pin any pipe of ours.